Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

Geek Culture / Trojan Lop.ax

Author
Message
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 12th Mar 2007 15:36
How do I remove this virus, AVG keeps detecting it and killing it, but it keeps coming back, I've googled and found nothing, but then again its me, so I may have likely missed something. It's not doing anything harmful, or as I can see, but it's bleeding annoying having a pop up coming up telling me to heal the virus.

So odd getting a virus soon after reinstalling XP, I only visited forum websites I normally visit, my gmail account and my XDrive account. The directory name (One I cannot find) includes 'IE5', I assume that refers to Internet Explorer 5 (its in some internet folder) but I only used Internet Explorer for one thing, to check for updates on XP...I know Microsoft is out to get me for all of the things I said about them behind their back, but surely they have better ways of plotting their revenge

Did The Buddha have a Zen micro?
JerBil
20
Years of Service
User Offline
Joined: 8th May 2004
Location: Somewhere along the Z axis...
Posted: 12th Mar 2007 16:01
Don't know, but maybe this will help.

[href]null[/href]http://www.lop-removal.com.removal-instructions.com/removeLop.html

Ad Astra Per Asper
Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 12th Mar 2007 16:12
I would recommend upgrading to IE7 if you haven't already done so. Might also be a good idea to use Windows update too if you haven't already.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
spooky
22
Years of Service
User Offline
Joined: 30th Aug 2002
Location: United Kingdom
Posted: 12th Mar 2007 16:22
I would not bother downloading that tool that JerBil linked to. There are thousands of links to that 'free' spyware scanner, unfortunately the scan is free but you have to pay them money to actually remove the trojan. Really annoying.

You would be better off downloading Lavasoft's Ad-Aware as it specialises in removing spyware and trojans and is free.

Boo!
indi
22
Years of Service
User Offline
Joined: 26th Aug 2002
Location: Earth, Brisbane, Australia
Posted: 12th Mar 2007 16:28
Firefox might have prevented an Internet Explorer exploit, but i dont know this particular trojan.
After reading it it looks specific to IE.

Spybot search and destroy's resident features "tea timer" and "sd helper" are highly recommended installs right at the get go if you continue to use IE as a browser for certain sites. SBS&D also has a host blocking file. update the program and check the hosts file twice in the advanced section, it will prevent naughty sites infecting you.
I would not recommend spyware scanner on the link above but rely on manual removal and stick with SBS&D plus Adawares spyware tool.

INFO Not really related to this trojan but :

If you were connected to the internet before SP2 was installed as well as AVG, it only takes 5 minutes to get an infection, this, Ive seen twice now with new installs on clients PC's who have rung me after it has happened.

usb sticks with data on them as well as burned media could of held a problem if they were not scanned, if the machine was prior infected and the actual virus can copy itself to other drives.

Other network machines on your network could also infect other machines.

JerBil
20
Years of Service
User Offline
Joined: 8th May 2004
Location: Somewhere along the Z axis...
Posted: 12th Mar 2007 18:36
I agree with the above, and would add that when you install xp,
the firewall is OFF by default, so turn it on before you access the 'net, otherwise malware is almost certain.

Ad Astra Per Asper
NeX the Fairly Fast Ferret
19
Years of Service
User Offline
Joined: 10th Apr 2005
Location: The Fifth Plane of Oblivion
Posted: 12th Mar 2007 19:02
I don't turn on the firewall. Why?
Every time I go onto an online game, whether I told it to remember my preferences or not, it crashes the game. If, by some miracle I escape from the clutches of XPF, I find it was quite innocently asking me if I wanted to block the very game I was playing.


Since the other one was scaring you guys so much...
indi
22
Years of Service
User Offline
Joined: 26th Aug 2002
Location: Earth, Brisbane, Australia
Posted: 12th Mar 2007 19:32
thats why you port map your games through the firewall.
dear me your asking for it without a firewall.

Phaelax
DBPro Master
21
Years of Service
User Offline
Joined: 16th Apr 2003
Location: Metropia
Posted: 12th Mar 2007 21:06
Run HijackThis and see if its loading some kind of service for the trojan at startup.

Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 12th Mar 2007 22:15 Edited at: 12th Mar 2007 22:18
Cheers dudes, I had 2 longer responses, but due another problem, they wouldn't post, so I am using a laptop here (I made the thread in the 6th form library and not on my main computer)

Thanks for all of the responses, I'm in the process of trying them out, currently using Search and Destroy.

The other problem, stopping me from posting (I won't start a new thread for this) has happened before, but then I had a spare modem to use instead until it somehow fixed itself, but now I don't have that modem.

The problem is that I cannot send data through forums or email, upload onto the internet or log onto MSN. I cannot access the modem settings on my computer, because they are username and password protected different to the ones I signed up with.

This is quite odd itself, 3 windows PCs and 2 macs are running from this modem(Not all at the same time, at the moment the 3 PCs, mine, my sister's and this laptop)1 PC Laptop and 1 MacBook running Wireless, 1 PC and 1 Mac running through ethernet and my PC through USB, those 4 computers run fine. Which I find logically confusing, if the modem had any filtering options, it would apply to them, surely.

Anyway, cheers dudes.

[edit]

Search and Destroy found various problems, stuff associated with Firefox, stuff not associated with anything, but nothing on IE or lop, unless it goes by other name.

Did The Buddha have a Zen micro?
NeX the Fairly Fast Ferret
19
Years of Service
User Offline
Joined: 10th Apr 2005
Location: The Fifth Plane of Oblivion
Posted: 12th Mar 2007 23:41
How the heck am I supposed to know what port every game in my collection uses for internet? It's not exactly in the manual.


Since the other one was scaring you guys so much...
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 13th Mar 2007 00:04
Or you could use a firewall that only asks you once for that game and leaves you alone afterwards, like Zone Alarm or Sygate.

Also, it seems to have worked. Search and destroy got rid of it, as the lop speciallised app found no errors.

Thanks dudes.

Did The Buddha have a Zen micro?
indi
22
Years of Service
User Offline
Joined: 26th Aug 2002
Location: Earth, Brisbane, Australia
Posted: 13th Mar 2007 04:52
ports are common knowledge on the internet for gaming

example : blizzard games
http://portforward.com/cportsnotes/battlenet/battlenet.htm

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 07:05
Quote: "Or you could use a firewall that only asks you once for that game and leaves you alone afterwards, like Zone Alarm or Sygate."

I used to use Zone Alarm until I realised it was causing a massive system instability.

Windows firewall is just fine if you know how to use it.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
indi
22
Years of Service
User Offline
Joined: 26th Aug 2002
Location: Earth, Brisbane, Australia
Posted: 13th Mar 2007 07:07
I agree with you there benjamin, I have stopped installing it on clients machines as well.

Phaelax
DBPro Master
21
Years of Service
User Offline
Joined: 16th Apr 2003
Location: Metropia
Posted: 13th Mar 2007 09:04
I've had no problem running ZoneAlarm, had it installed for years now. I once tried Sygate and it was just horrible garbage.

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 09:32
Quote: "I've had no problem running ZoneAlarm, had it installed for years now. "

May have just been a certain build then. I remember installing it after a fresh install of XP and it would lock up the system on startup 90% of the time. Another thing was that if I pressed the middle mouse button the PC would crash. I'm not entirely sure how it would cause the latter, but I'm certain it did after doing a lot of experimenting.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 13th Mar 2007 13:11
zone alarm and sygate work fine for me,like win firewall, you just gotta know how to use it Zone Alarm and Sygate don't seem too different, hence I'm using Sygate instead.

Did The Buddha have a Zen micro?
UnderLord
21
Years of Service
User Offline
Joined: 2nd Aug 2003
Location:
Posted: 13th Mar 2007 15:11
LOL I love me some Sygate =)

"I have noticed even people who claim everything is predestined, and that we can do nothing to change it, look before they cross the road."
dab
20
Years of Service
User Offline
Joined: 22nd Sep 2004
Location: Your Temp Folder!
Posted: 13th Mar 2007 17:20
Quote: "I used to use Zone Alarm until I realised it was causing a massive system instability."


Samme here, it caused BSOD on me, and even uninstalling it wouldn't save my comp. I even upgraded which didn't do anything. So I'm not using Zone Alarm anymore. I'll need to find another firewall since Windwos firewall doesn't quite do what I want. Even though it works for what I need.

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 17:22 Edited at: 13th Mar 2007 17:24
Quote: "Samme here, it caused BSOD on me, and even uninstalling it wouldn't save my comp."

I think I also tried uninstalling it. The last time I tried using it, I had made a system restore point, so I just reverted the system back to its previous state and it was fine. This is how I realised that it was ZoneAlarm causing it. Of course, during this period of finding the problem I reinstalled Windows about 5 times. Took quite a while.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Silvester
18
Years of Service
User Offline
Joined: 7th Dec 2005
Location: Netherlands
Posted: 13th Mar 2007 18:06
Cool,atleast im not the only one with this darn trojan.i have Panda AND AVG and it still doesnt want to delete it...

Anyway,as soon as i find that piece of crap ill delete him myself...

Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 13th Mar 2007 19:55 Edited at: 13th Mar 2007 19:58
Anyone got any advice on my second problem? The internet connection one. (Its on one of my last couple of posts)

@P of D, there are good solutions in this thread. I think the important thing to consider, is to use Anti-virus (AVG), Anti Spyware (Adaware/Spybot: Search and Destroy) and a Firewall (Sygate) It seems this Trojan is detectable in an anti virus, but won't kill it completely, as it seems to sit in your registry. Remove it as spyware, but be careful when removing it, it seems it could create problems in your registry (as it has done to mine) luckily Spybot, will back up your registry and you can undo spyware removals.

As I've just said to Prince, I got a registry problem, explorer won't load on start, I'm going to try a registry fixer I was recommended a little while back, so I won't have to undo anything in Spybot and hope all is clean afterwards.

I must note how incredibly annoying it is that such things can be easily acquired, I'd hate to be a new PC user now, luckily when I started using them it was safer on the net. Also, its extremely annoying after a start up, I know it would annoy my Dad if I couldn't get rid of it and place the blame on me for 'Downloading files I shouldn't be' etc. But I've only downloaded DBP update 6.5, Torque 1.4.2 and torque resources from garage games and all of those security programs I need.

Did The Buddha have a Zen micro?
Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 20:17 Edited at: 13th Mar 2007 20:29
Maybe the problem is your firewall.. Try temporarily disabling it.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 13th Mar 2007 20:22 Edited at: 13th Mar 2007 20:23
Ooh not a good idea if I don't have anything to take it's place, I don't have SP2 on my computer, meaning no Windows Firewall and I can't grab the update because of problem number 2. (Same reason why I can't post on the internet with it and why I'm having to use this laptop to post my issues)

Strangley, I still keep having software connecting to the internet when it wouldn't normally, although nothing except the firewall is detecting it. But everything else appears to be fine. I could steal Zone Alarm again from my sister's room, or/and Norton AV, but I don't have faith in Norton and ZA seems to be exactly like sygate in how well it protects.

Perhaps I'll do that if I have something to pick it up if it falls, I don't want to run the risk of recieving stuff I don't want, but thanks anyway.

Did The Buddha have a Zen micro?
Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 20:30 Edited at: 13th Mar 2007 20:33
Quote: "Ooh not a good idea if I don't have anything to take it's place"

You're not behind a router? They give pretty good protection. Especially if it's an "annoying" router..

If you don't want to disable your firewall, have you at least checked its exceptions/rules for the programs that won't work?

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Mikey P
19
Years of Service
User Offline
Joined: 23rd May 2005
Location: Manchester, UK
Posted: 13th Mar 2007 21:21
Quote: "The problem is that I cannot send data through forums or email, upload onto the internet or log onto MSN. I cannot access the modem settings on my computer, because they are username and password protected different to the ones I signed up with."

Quote: "I don't have SP2 on my computer"


These two things, are very much related. After my last format, I didn't update to SP2 for a few days, and then I had the same problem as you, it was most definitely a virus - I can't remember how I came to this conclusion, but I'm certain, and even after I updated to SP2 and tried various things I couldn't fix it. In the end, I'd decided, since everything was still backed up, it'd just be easier to reformat, and install SP2 (from a USB stick) before I connected to the internet atall.. and well, it didn't come back.

I think there are a couple of sites with possible solutions, but as I said, I couldn't get them to work, maybe you'll have more luck. By the sounds of your PC's health it might be more worth while to reformat.

Also, just to be sure we are talking about the same thing, if you open a command prompt (Win+R "cmd"), and type "ping google.com" - or even, to be sure, pinging another PC on the network, it should ping with no problems.

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 13th Mar 2007 21:27
I just think it's wise to always install the latest security updates when you install an operating system, and always download what you believe to be the most secure programs for what you do. For example, get IE7 and Firefox straight away.

Quote: "I didn't update to SP2 for a few days"

You live life on the edge my friend.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 13th Mar 2007 22:49 Edited at: 13th Mar 2007 22:50
Quote: "You're not behind a router? They give pretty good protection. Especially if it's an "annoying" router...

If you don't want to disable your firewall, have you at least checked its exceptions/rules for the programs that won't work?"


I am using a router, I didn't realise they offered good protection, but I'll at least check those settings. If routers do offer good protection, then I suppose that's why I can't send any data, but then wouldn't that apply to all other computers that use it, the only difference between that one and all of the other Windows computer in the house running off it, is that it uses the USB port the others use wireless/ethernet (Because my PC is too old to have an ethernet port as standard...)

Cheers.

@Mikey, I did a reformat soon before posting here, that was my cure for my awful performance issues in another thread, as it seemed there were not more answers. The connection issue has been here since the reformat and it happened initially when I installed this modem with our upgrade from 3mb to 12mb broadband. The solution then was to use my old modem, a few months later I tried the newer modem and it worked, unfortunately, this time I don't have that modem. As for the SP2 upgrade, believe or not that was the only reason I went into Internet Explorer, which apparently the trojan I had was connected with it, as I put the Firefox install file onto my backup disk hoping I'd never need IE again. When I tried to do an update with SP2, the update service wouldn't work on each attempt, because of this strange internet connection.

Also, I suppose this SP2 thing is a real necessity for stability in Windows then? So really, until I get those updates, I am vunerable to more Trojans (As I'm not convinced I got rid of everything through all of those scans)

I hope Microsoft have a solid install of SP2 that I can access through FF, I've already searched their download center, but I guess either it's not their, or they don't have a good search engine on the site.

I bet I wouldn't have these issues with Win2k or MacOS X What are apparently as the two best non-free OS's out there.

[edit] please note I only mean that last statement in context with my needs, not anybody elses.

Did The Buddha have a Zen micro?
Phaelax
DBPro Master
21
Years of Service
User Offline
Joined: 16th Apr 2003
Location: Metropia
Posted: 14th Mar 2007 03:38
Quote: "I bet I wouldn't have these issues with Win2k or MacOS X"


Funny, I run both of them and don't have any trojan problems. :-p

I have an SMC router thats set to not let anyone on the network unless it detects ZoneAlarm running on their machine. It has a built-in firewall as well, but it caused me too many headaches.

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 14th Mar 2007 08:17 Edited at: 14th Mar 2007 08:20
Quote: "If routers do offer good protection, then I suppose that's why I can't send any data"

Data can be sent out fine, but data from the WAN will be blocked if a mapping hasn't been set up for it (which is the protection it offers). What this means is if you have a keylogger on your system it won't block that, due to only blocking incoming connections/packets.

Quote: "I bet I wouldn't have these issues with Win2k or MacOS X"

I bet you also wouldn't be able to run your favourite programs either.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 14th Mar 2007 15:55
I see, well, the chances are my Dad will know all of the password and access stuff for the router. I know little on doing all of this stuff with a router, I'll use the internet if the actual settings aren't straight forward enough for my liking.

Quote: "I bet you also wouldn't be able to run your favourite programs either."


I would, well Mac OS would run less, but I can handle that, but Win2k would run everything. But the only obstacle is money, if I had money, I'd have a better solution to my love hate relationship with my comp by getting a new one. I should get a job, but I've been saying that for a year

Did The Buddha have a Zen micro?
Mikey P
19
Years of Service
User Offline
Joined: 23rd May 2005
Location: Manchester, UK
Posted: 14th Mar 2007 18:03
I'd been using Firefox with no problems too, it was those few moments of weakness updating in IE. I've used the download of SP2 off softpedia a few times with no problems, but there's probably a downloadable copy on Microsoft's site that I just can't find.

Phaelax
DBPro Master
21
Years of Service
User Offline
Joined: 16th Apr 2003
Location: Metropia
Posted: 14th Mar 2007 19:07
Quote: "(win2k,MacOSX) I bet you also wouldn't be able to run your favourite programs either."


I run everything I need just fine, except for AoE3.

Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 14th Mar 2007 19:11
Quote: "I run everything I need just fine, except for AoE3."

Brilliant, except that comment wasn't aimed at you.

I'm completely independent using Linux apart from when I want to play any games or do any programming. Considering that pretty much covers all I do.. I'd say Windows is quite a requirement for me.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
WarGoat
20
Years of Service
User Offline
Joined: 19th Sep 2004
Location: Montreal
Posted: 15th Mar 2007 01:02
I suggest using Avast! antiviruse, its a free anti viruse very powerfull that you can download here: http://www.avast.com/eng/download-avast-home.html
Just downlaod and register, and do a scan on the rebooting of your computer, and it should check all of your files to check for viruses and destroy them all.


Windows XP,pentium IV, 3.0 MGZ, 1024 mb memory, 256 mb ATI Radeon PCIE X700 Pro 'sett squadron back on the assault'
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 15th Mar 2007 20:04 Edited at: 15th Mar 2007 20:32
All appears to be well now, I'll try that one out if I have further issues sett, cheers.

Good news is, I am on MSN now, so hopefully this post will go through.


[edit]

Yey! It posted, but posting seems to be a hit and miss, don't know why, but I've had enough with fiddling with my computer for this week, so it can wait.

Did The Buddha have a Zen micro?
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 17th Mar 2007 12:59
I still keep finding Trojans when I do a scan, now there's been a folder sitting in C:/ that I've never seen in my life, during the install of SP2 I saw that folder, either to store temp files or something else, it's subfolder is inaccessible.

The Folder name is:

C:/1ae83cd52e4220e95a1451

and the subdirectory:

/i386

This I find quite odd, should this exist? Or should I kick it's arse?

Also if I'm still get trojans, there must be something downloading them that none of my security (Spybot, BT Anti Spyware, AVG, Sygate(Although it's stopping rogue internet connections) ) can detect, does this mean there is late hope in free software as I'd like to imagine?

Did The Buddha have a Zen micro?
Benjamin
21
Years of Service
User Offline
Joined: 24th Nov 2002
Location: France
Posted: 17th Mar 2007 13:22
I have a similar folder, so no I don't think you should.

Tempest (DBP/DBCe)
Multisync V1 (DBP/DBCe)
Seppuku Arts
Moderator
20
Years of Service
User Offline
Joined: 18th Aug 2004
Location: Cambridgeshire, England
Posted: 17th Mar 2007 17:00
Fairplay, but Internet Explorer opening itselfs and processes such as Task Manager and Explorer wanting to access the internet are confusing as to why they are there, nothing can detect what's doing this and it is really getting on my nerves.

Did The Buddha have a Zen micro?
Suicidal Sledder
20
Years of Service
User Offline
Joined: 17th Aug 2004
Location: Tikrit, Iraq
Posted: 19th Mar 2007 20:28
1) use firefox...

2) im assuming u have the file loaation? Just boot in safe mode without networking (press f8 while booting) and open ur browser. Type in the full directory of the file. Even tho it may seem the folders dont exist, they are there. Once in the folder simply delete the file. If it says that its in use and cannot be modified, open task manager and look for any suspicious processes. end them, delete the file. Dont forget to empty your recycle bin!

ive used that methed probably a dozen times and havnt had a problem since. hope it helps!!


Any Qs email me at aoeii@wowway.com

Login to post a reply

Server time is: 2024-11-18 09:25:24
Your offset time is: 2024-11-18 09:25:24